Office (OLE) / .PPT malware analysis — malicious · 1a88536d2164d6c3

MALICIOUS

Office (OLE) / .PPT

70.0 KB Created: 2021-09-12 20:21:15 Authoring application: Microsoft Office PowerPoint

MD5: eb016236613647c59e5e4ca81904718f SHA-1: b3c73896095ae23ae05a6c942325ab904c811203 SHA-256: 1a88536d2164d6c3b6d050a5f766dd703b69a49d8174586993b1266f806a5b22

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is a PowerPoint file containing VBA macros. The Auto_Close macro is triggered upon closing the presentation, and it uses GetObject to execute code. The script reconstructs a URL, 'http://bitly.com/HHTTappbitly.com/dasdaasfasfabdjtywqecdna', which is likely used to download and execute a second-stage payload. The use of Auto_Close and GetObject indicates a malicious intent to run arbitrary code.

Heuristics 4

Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b12a9ab03f5b2f197d5a6981741369a3a20bdf19310c5ced1ccb6c559b649d98`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.